An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777540774 advisory.

  - An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before     7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
    (CVE-2018-14883)

  - University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products,     launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen     function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote     attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a     user of a web application) and if rsh has been replaced by a program with different argument semantics.
    For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an     IMAP server name containing a -oProxyCommand argument. (CVE-2018-19518)

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read     in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual     data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
    (CVE-2018-20783)

  - Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in     str_lower_case_match in regexec.c. (CVE-2019-19246)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before     7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
    (CVE-2018-14883)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products,
    launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen
    function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote
    attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a
    user of a web application) and if rsh has been replaced by a program with different argument semantics.
    For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an
    IMAP server name containing a "-oProxyCommand" argument. (CVE-2018-19518)

  - Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library
    (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to
    decrementing the u variable. (CVE-2016-10166)

  - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before
    7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
    (CVE-2018-5712)

  - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before
    7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read
    and application crash) via a crafted JPEG file. (CVE-2018-14851)

  - An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before
    7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
    (CVE-2018-14883)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before
    7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read
    and application crash) via a crafted JPEG file. (CVE-2018-14851)

  - An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before
    7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
    (CVE-2018-14883)

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.37 or 7.1.x prior to 7.1.20. It is, therefore, affected by a denial of service vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: The EXIF module was susceptible to denial of service/information disclosure when parsing malformed images, the Apache module allowed cross-site-scripting via the body of a 'Transfer-Encoding: chunked' request and the IMAP extension performed insufficient input validation which can result in the execution of arbitrary shell commands in the imap_open() function and denial of service in the imap_mail() function.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.7.1. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3766-1 advisory.

    It was discovered that PHP incorrectly handled restarting certain child processes when php-fpm is used. A     remote attacker could possibly use this issue to cause a denial of service. This issue was only addressed     in Ubuntu 18.04 LTS. (CVE-2015-9253)

    It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2018-14851,     CVE-2018-14883)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php53 fixes the following issues :

The following security issues were fixed :

CVE-2018-14851: Fixed an out-of-bound read in exif_process_IFD_in_MAKERNOTE, which could be exploited by an attacker via crafted JPG files, and could result in an application crash.
(bsc#1103659)

CVE-2018-14883: Fixed an integer overflow leading to a heap-based buffer over-read in exif_thumbnail_extract of exif.c. (bsc#1103836)

CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. One (CVE-2018-14851) results in a potential denial of service (out-of-bounds read and application crash) via a crafted JPEG file. The other (CVE-2018-14883) is an Integer Overflow that leads to a heap-based buffer over-read.

Additionally, a previously introduced patch for CVE-2017-7272 was found to negatively affect existing PHP applications (#890266). As a result of the negative effects and the fact that the security team has marked the CVE in question as 'ignore,' the patch has been dropped.

For Debian 8 'Jessie', these problems have been fixed in version 5.6.37+dfsg-0+deb8u1.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.(CVE-2018-14851)

exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.(CVE-2018-12882)

An issue was discovered in PHP 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.(CVE-2018-14883)

exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, and 7.1.x before 7.1.20, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.(CVE-2018-14851)

An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, and 7.1.x before 7.1.20. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.(CVE-2018-14883)

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.20. It is, therefore, affected by a denial of service vulnerability.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.37. It is, therefore, affected by a denial of service vulnerability.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.8. It is, therefore, affected by a Use-After-Free Arbitrary Code Execution Vulnerability.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.31. It is, therefore, affected by a Use-After-Free Arbitrary Code Execution Vulnerability.

ID	Name	Product	Family	Type	Severity
352408	CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777540774)	Nessus	CentOS Local Security Checks	Local	high
222157	Linux Distros Unpatched Vulnerability : CVE-2018-14883	Nessus	Misc.	Local	high
406312	Alpine: php7: security update to 7.1.29-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
406312	Alpine: php7: security update to 7.1.29-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
406296	Alpine: php5: security update to 5.6.37-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
406296	Alpine: php5: security update to 5.6.37-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
98875	PHP 7.1.x < 7.1.20 exif_thumbnail_extract() DoS	Web App Scanning	Component Vulnerability	Version Based	high
98874	PHP 5.6.x < 5.6.37 exif_thumbnail_extract() DoS	Web App Scanning	Component Vulnerability	Version Based	high
119561	Debian DSA-4353-1 : php7.0 - security update	Nessus	Debian Local Security Checks	Local	high
117672	Tenable SecurityCenter < 5.7.1 Multiple Vulnerabilities (TNS-2018-12)	Nessus	Misc.	Combined	critical
117539	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-3766-1)	Nessus	Ubuntu Local Security Checks	Local	high
117449	SUSE SLES11 Security Update : php53 (SUSE-SU-2018:2681-1)	Nessus	SuSE Local Security Checks	Local	high
112229	Debian DLA-1490-1 : php5 security update	Nessus	Debian Local Security Checks	Local	high
112094	Amazon Linux AMI : php72 (ALAS-2018-1067)	Nessus	Amazon Linux Local Security Checks	Local	critical
112093	Amazon Linux AMI : php56 / php70,php71 (ALAS-2018-1066)	Nessus	Amazon Linux Local Security Checks	Local	high
111231	PHP 7.1.x < 7.1.20 exif_thumbnail_extract() DoS	Nessus	CGI abuses	Remote	high
111230	PHP 5.6.x < 5.6.37 exif_thumbnail_extract() DoS	Nessus	CGI abuses	Remote	high
111216	PHP 7.2.x < 7.2.8 Use After Free Arbitrary Code Execution in EXIF	Nessus	CGI abuses	Remote	critical
111215	PHP 7.0.x < 7.0.31 Use After Free Arbitrary Code Execution in EXIF	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2018-14883

high

Tenable Plugins

high

high

critical

critical

high

high

high

high

high

critical

high

high

high

critical

high

high

high

critical

critical